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DETAILED ACTIONS 
Drawings 

The drawings of Figure 3 are objected to because the reference numbers not 
pointing to any particular entity. For example, 300 and 310 are not referencing any 
elements of the monitoring system. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-27 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bruins et al (US Patent 6,308,148) in view of Merriam (US Patent 6,587,878). 

Claim(s) 1,10: Bruins teaches a method to monitor a network by a network monitor, 
comprising: 

routing data packets through a router (col. 2, lines 20-21; wherein the function of 
a router is to route data packets through its interfaces); 

generating flow records for at least some of said data packets (col. 2, lines 23-24; 
wherein the router is collecting or generating flow information to be used); 
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filtering said at least some of the flow records (col. 2, lines 36-40); and 

extracting packet information from the filtered flow records (col. 3, lines 66-67), 
wherein the extracted packet information comprises internet information of at 
least one target of interest (col. 4, lines 9-17; wherein the target of interest is the 
selected range of source addresses that originate from the internet domain 
"cisco.com" or in the second case, the target of interest is the selected protocol 
type such as the "FTP" protocol). 

Bruins, however, fails to teach performing active measurements to said target of 
interest using the extracted packet information. 

Marriam, in an analogous art, teaches a performance measurement program to 
measure actual performance data from/to target, downloaded web pages (col. 5, 
lines 29-31 and col. 9, lines 45-50). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine and use Bruins' method of extracting packet information 
from the filtered flow records with Marriam's performance measurement program 
to measure actual performance data extracted from the filter. The reason why 
Bruins would want to combine is because Bruins would want to use Marriam's 
performance measurement result to adjust the parameters of the network to 
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make the network perform more efficiently (Abstract of Bruins, next to last 
sentence). 

Claim(s) 2,11: Bruins and Marriam teach the method according to claim 1 , said filtering 
step comprising: 

selecting flow records based on an address field of said flow records (col. 2, lines 
24-25 Bruins). 

Claim(s) 3, 4, 12, 13: Bruins and Marriam teach the method according to claim 2, said 

filtering step comprising 

selecting flow records having destination or source of non-local hosts (col. 3, 
lines 21-23 Bruins; wherein the destination are host from the "internet" which 
implies non-local and local hosts. It is well known in the art that a method can 
filter flow records that have source and/or destination host from a local subnet or 
other subnets). 

Claim(s) 5, 14: Bruins and Marriam teach the method according to claim 5, said filtering 
step comprising: 

selecting flow records containing critical services based on the address field or a 
port field of the records (col. 2, lines 28-32 and col. 3, lines 25-39 Bruins). 
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Claim(s) 6, 15: Bruins and Marriam teach the method according to claim 1 , said filtering 
step comprising: 

randomly selecting data packets from said filtered data packets (col. 2, lines 36- 
38; wherein each filter randomly selects only a subset of the total flows). 

Claim(s) 7, 8, 16, 17: Bruins and Marriam teach the method according to claim 1, 
said active measurement comprise a ping and a traceroute process (Official 
Notice is taken of active measurement comprise ping and traceroute process. It 
is well known in the art at the time of the invention to use these processes in 
active measurement of network performance). 

Claim(s) 9, 18: Bruins and Marriam teach the method according to claim 1, wherein 
said active measurements are selected based on said target of interest (col. 5, 
lines 29-31 and col. 9, lines 45-50 and FIG. 1, ref. Server probe and remote 
probes of Marriam). 

Claim(s) 19: Bruins and Marriam teach a method to monitor a network by a network 
monitor, comprising: 

routing data packets through a router (col. 2, lines 20-21; wherein the function of 
a router is to route data packets through its interfaces); 
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generating flow records for at least a fraction of said data packets (col. 2, lines 
23-24 and col. 2, lines 38-39; wherein the router is collecting or generating flow 
information to be used and the filters select only a subset or fraction of the flows 
or filtered data packets); 

extracting packet information from at least a fraction of said flow records (col. 3, 
lines 66-67), wherein the extracted packet information comprises internet 
information of at least one target of interest (col. 4, lines 9-17; wherein the target 
of interest is the selected range of source addresses that originate from the 
internet domain "cisco.com" or in the second case, the target of interest is the 
selected protocol type such as the "FTP" protocol); and 

performing active measmements to said target of interest using the extracted 
packet information. 

Bruins, however, fails to teach performing active measurements to said target of 
interest using the extracted packet information. 

Marriam, in an analogous art, teaches a performance measurement program to 
measure actual performance data from/to target, downloaded web pages (col. 5, 
lines 29-31 and col. 9, lines 45-50). 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine and use Bruins' method of extracting packet information 
from the filtered flow records with Marriam's performance measurement program 
to measure actual performance data extracted from the filter. The reason why 
Bruins would want to combine is because Bruins would want to use Marriam's 
performance measurement result to adjust the parameters of the network to 
make the network perform more efficiently (Abstract of Bruins, next to last 
sentence). 

Claim(s) 20: Bruins and Marriam teach the method of claim 19, said generating step 
comprising: 

filtering said data packets (col. 2, lines 36-40 Bruins); and 

creating flows records for said filtered data packets (col. 2, lines 23-34 Bruins). 

Claim(s) 21: Bruins and Marriam teach the method of claim 20, said extracting step 
comprising: 

sampling said generated flow records (col. 2, line 38 Bruins); and 

obtaining packet information from said sampled flow records (col. 2, lines 25-26 

Bruins). 

Claim(s) 22: Bruins and Marriam teach the method of claim 20, said filtering step 
comprising: 
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selecting flow records based on an address field of said flow records (col. 2, lines 
24-25 Bruins). 

Claim(s) 23, 24: Bruins and Marriam teach the method of claim 20, said filtering step 
comprising 

selecting flow records and/or data packets having destination or source of non- 
local or local hosts (col. 3, lines 21-23 Bruins; wherein the destination are host 
from the "internet" which implies non-local and local hosts. It is well known in the 
art that a method can filter flow records and/or data packets that have source 
and/or destination host from a local subnet or other subnets). 

Claim(s) 25: Bruins and Marriam teach the method of claim 20, said filtering step 
comprising 

selecting flow records containing critical services based on the address field or a 
port field of the flow records (col. 2, lines 28-32 and col. 3, lines 25-39 Bruins). 

Claim(s) 26, 27: Bruins and Marriam teach the method according to claim 19, wherein 
said active measurements comprise a ping and a traceroute process (Official Notice is 
taken of active measurement comprise ping and traceroute process. It is well known in 
the art at the time of the invention to use these processes in active measurement of 
network performance). 
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Conclusion 

Any inquiry concerning this communication or earlier communications from the 
Examiner should be directed to Tan Lien whose telephone number is (703) 305- 
6018. The examiner can normally be reached on Monday-Thursday from 8:30am to 
6pm. The examiner can also be reached on alternate Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached at (703) 305-4003. The fax phone 
number for this Group is (703) 305-3718. 

Communications via Internet e-mail regarding this application, other than those 
under 35 U.S.C. 132 or which otherwise require a signature, may be used by the 
applicant and should be addressed to [tan.lien@uspto.gov]. 

All Internet e-mail communications will be made of record in the application file. 
PTO employees do not engage in Internet communications where there exists a 
possibility that sensitive information could be identified or exchanged unless the 
record includes a properly signed express waiver of the confidentiality requirements 
of 35 U.S.C. 122. This is more clearly set forth in the Interim Internet Usage Policy 
published in the Official Gazette of the Patent and Trademark on February 25, 1997 
at 1195 OG 89. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the Group receptionist whose telephone number is 
(703) 305-3900. 
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